Pin fontbuilder image deps via uv-managed requirements.txt

Replace the unpinned pip3 install of scikit-image/scipy/matplotlib/parse
with a uv-compiled lockfile. The Dockerfile installs from the lockfile,
so layer-cache eviction can no longer silently pull newer matplotlib
versions and shift gen_charmap.py output.

The pinned versions match what the previously-cached fontbuilder image was
already running, so no sample regeneration is required and the font/sample
diff against master is empty.

Direct deps live in requirements.in; the lockfile is produced by:

  uv pip compile xkcd-script/generator/requirements.in \
      -o xkcd-script/generator/requirements.txt --python-version 3.12

To upgrade a dep, edit requirements.in (or pass --upgrade-package) and
re-run the compile.

Author: pelson

xkcd-script/generator/Dockerfile

@@ -9,5 +9,10 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
         python3-pip \
     && rm -rf /var/lib/apt/lists/*
 
-RUN pip3 install --break-system-packages \
-        scikit-image scipy matplotlib parse
+# Direct deps are listed in requirements.in; requirements.txt is a fully
+# resolved lockfile produced by `uv pip compile`. Regenerate after editing
+# requirements.in:
+#   uv pip compile xkcd-script/generator/requirements.in \
+#       -o xkcd-script/generator/requirements.txt --python-version 3.12
+COPY requirements.txt /tmp/requirements.txt
+RUN pip3 install --break-system-packages -r /tmp/requirements.txt

xkcd-script/generator/requirements.in

@@ -0,0 +1,4 @@
+scikit-image
+scipy
+matplotlib
+parse

xkcd-script/generator/requirements.txt

@@ -0,0 +1,18 @@
+contourpy==1.3.3
+cycler==0.12.1
+fonttools==4.62.1
+imageio==2.37.3
+kiwisolver==1.5.0
+lazy-loader==0.5
+matplotlib==3.10.9
+networkx==3.6.1
+numpy==2.4.4
+packaging==26.2
+parse==1.22.0
+pillow==12.2.0
+pyparsing==3.3.2
+python-dateutil==2.9.0.post0
+scikit-image==0.26.0
+scipy==1.17.1
+six==1.17.0
+tifffile==2026.5.2